The Total Economic Impact™ Of Semperis

Improved Business Continuity Due To Faster Hybrid AD Attack Recovery

Evidence and data. Interviewees said that investing in Semperis’ ADFR solution enabled swift AD recovery, minimizing the financial impact of the attack by mitigating prolonged disruptions to business operations. Throughout the duration of the attack, a compromised AD meant that employees were locked out and therefore could not access their accounts and resources to continue their work. This cost of downtime was compounded by a reduction in revenue attributable to the inability to serve customers due to inaccessible systems and missed sales opportunities. With Semperis, all interviewees noted that the full AD-recovery timeline was reduced from several days to just a few hours. The automation capabilities of ADFR simplified the previously complicated, error-prone, multi-step process to a few clicks. In turn, the Semperis investment allowed interviewees’ organizations to bounce back quickly after a hybrid AD attack and reestablish operational stability, ultimately cutting revenue losses, reputational damage, potential litigation and fines, and labor losses.

• The manager of identity management and engineering in healthcare explained that prior to Semperis, recovering from an AD attack and ensuring a ransomware-free backup of data took two weeks. The manager also noted that in the prior environment, their organization had to enlist third-party services in addition to internal resources to restore their data. After implementing Semperis, it took less than two business days to conduct recovery and post-recovery activities without the help of any external resources and return to normal.
  
  The manager explained: “It was ADFR that prompted our investment in Semperis because of the risk to the organization around restoring our forests after an AD-related ransomware attack. Being able to manage the AD recovery process more effectively and efficiently is what got us to move away from a bare metal image backup to get back up and running with a fully functioning Active Directory more quickly.”
  
  Interviewees noted that ADFR also automated time-consuming administrative cleanup tasks following an AD recovery, such as rebuilding the Global Catalog and restoring metadata, which resulted in further time savings.
  The manager of identity management and engineering continued: “Once AD is brought back online, it’s ready for business. [Other tools] typically require a lot of cleanup that has to occur before you can release it back to the business.”
• The senior manager of server architecture in energy said that recovering from an AD-related ransomware attack without Semperis would take at least one week of effort from their entire AD team, IT access admin team, ID management team, and project managers. With Semperis in place, this timeline was reduced to 6 hours to resume business operations.
• The CISO in healthcare reported that the time it took their organization to recover from an AD attack with Semperis and ensure that all backup data was ransomware-free dropped from three weeks to 4 hours. The CISO emphasized that this reduction was critical to the business because 1 hour of downtime costs several million dollars for the healthcare organization.
  
  The CISO in healthcare described the time savings their organization reaped during the post-recovery process with ADFR’s automated malware-proof backup capability: “Being able to do a few clicks and get the restoration from a backup is huge — it’s like night and day. [Before Semperis], recovery was a nightmare because it was so complex and required a lot of resources. Having the ability to restore from a backup of AD at your fingertips is huge. … It’s mind-boggling how simple it is.”

• The SVP in financial services said that an AD attack without ADFR would render their entire bank inoperable for weeks and would impact at least 25,000 people until full recovery was achieved. They also explained that a single hour of downtime costs the business several million dollars because every segment of the business relies on AD to function.
  
  The SVP described the impact of an AD-related ransomware attack on their customers, “Active Directory supports authentication and authorization, so an AD-related attack not only breaks down the internal workforce production but also impacts our customers’ ability to interact with the bank because they rely on AD for authorization.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Forrester quantifies the cost of 1 hour of downtime based on the lost labor due to end-user downtime and lost revenue from stalled operations. For every hour that Active Directory is down, the composite organization experiences combined labor and revenue losses of $2.7 million.
• In the legacy environment, it takes the composite organization 48 hours to recover from an AD-related ransomware attack using the legacy backup tool or manual approach. Note, in environments without an AD-specific backup and recovery solution, 48 hours for recovery is an extremely conservative estimate made for the purpose of financial modeling. Most companies Forrester interviewed estimated that a full AD recovery would range from many days to several weeks or even months of downtime.
• Semperis’ ADFR tool reduced the time it takes for the composite organization to recover from a hybrid AD attack by 90%.
• The probability of experiencing a ransomware attack that infects Active Directory varies greatly across organizations of diverse firmographics. As such, for this financial analysis, Forrester makes an extremely conservative assumption that the composite organization has a 2.0% chance of experiencing an AD-related ransomware attack. Based on Benefit B, the composite organization experiences a 25% reduction in the average likelihood of AD-related ransomware attack, making the likelihood of an attack 1.5% for the composite organization.

Risks. Improved business continuity due to faster AD attack recovery may vary depending on the following:

• The elements taken into consideration when calculating the cost of 1 hour of downtime.
• The average likelihood of an AD-related ransomware attack, which may vary depending on organizational size and industry, security posture, user awareness and training, backup and recovery practices, and external threat landscape.
• The hybrid AD attack recovery time in the prior environment.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $3.9 million.

Improved Business Continuity Due To A Reduction In The Likelihood Of A Successful Hybrid AD Attack

Evidence and data. Interviewees noted that in conjunction with ADFR, their organizations reduced the likelihood of a successful AD attack by using Semperis’ DSP tool to continuously monitor hybrid AD activities, including user authentication, access requests, and changes to AD and Entra ID configurations for unusual or suspicious activities. The ability to analyze log data, authentication attempts, and changes to AD and Entra ID configurations in real time with DSP helped the interviewees’ organizations identify potential threats before they escalated to full-blown attacks. DSP’s advanced features also enabled automated remediation to recognize threats and automatically roll back unauthorized changes, reducing the chances of a ransomware attack that compromises AD. Through this reduction, the interviewees’ organizations protected additional business value on top of what they retained with ADFR in Benefit A, further improving business continuity.

• The network systems analyst in healthcare explained how DSP enabled better oversight of their organization’s hybrid AD environment to prevent issues before they occur: “DSP helps us mitigate issues before they become issues. With Semperis, we’re able to identify user accounts that have possibly been tampered with and notify those users before a larger problem arises. Also, it helps us identify weaknesses in our [AD environment] so we can actually address them. It’s just a wonderful tool.”
• The CISO in healthcare said: “Having the knowledge that there was no dormant threat lying within our Active Directory somewhere waiting to pounce was a huge sigh of relief. In the past, we’ve experienced AD attacks where our backup was only partially clean, and we did not know if we had remnants of ransomware. Semperis gives us the peace of mind that nothing is lying dormant. Having that knowledge is a huge relief.”
  They continued: “Before DSP, we had zero visibility into our [hybrid AD environment]. Today, we have a tool that generates alerts that we’re able to actively validate whether or not we have a threat in the system rather than finding out after an attack happens. It’s an intrusion prevention system for us. That’s worth its weight in gold.”

• The technical architect of AD in professional services described how Semperis reduced the risk of reinfection and provided post-breach forensics to prevent repeat attacks. The interviewee explained: “Semperis helps us conduct post-recovery cleanup activities to ensure that an AD attack does not resurface. It guarantees that we have a ransomware-free environment. We would not be able to get a clean restore without Semperis.”
• The SVP in financial services said: “Semperis provides more targeted recovery in the case of a ransomware attack. It gives us greater control to support business resiliency and allows us to continue to harden our AD environment to reduce the attack surface. Without [DSP], it can be very difficult to narrow down threats.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Forrester quantifies the cost of 1 hour of downtime based on the lost labor due to end-user downtime and lost revenue from stalled operations. For every hour that Active Directory is down, the composite organization experiences combined labor and revenue losses of $2.7 million.
• In the legacy environment, it takes the composite organization 48 hours to recover from an AD-related ransomware attack using the legacy backup tool or manual approach. Note, in environments without an AD-specific backup and recovery solution, 48 hours for recovery is an extremely conservative estimate done for the purpose of financial modeling. Most companies Forrester interviewed estimated that a full AD recovery would range from many days to several weeks or even months of downtime.
• Semperis’ ADFR tool reduces the time it takes for the composite organization to recover from an AD attack by 90%.
• The probability of experiencing a ransomware attack that infects Active Directory varies greatly across organizations of diverse firmographics. As such, for this financial analysis, Forrester makes an extremely conservative assumption that the composite organization has a 2.0% chance of experiencing an AD-related ransomware attack.
• Through continuous monitoring of the AD and Entra ID environments with DSP, the composite organization reduces the likelihood of a successful hybrid AD attack from 2.0% to 1.5% — a 25% reduction.

Risks. Improved business continuity due to a reduction in the likelihood of a successful hybrid AD attack may vary depending on the following:

• The elements taken into consideration when calculating the cost of 1 hour of downtime.
• The average likelihood of an AD-related ransomware attack before investing in Semperis, which may vary depending on organizational size and industry, security posture, user awareness and training, backup and recovery practices, and external threat landscape.
• The reduction in the average likelihood of a successful AD-related ransomware attack with Semperis.
• The AD attack recovery time in the prior environment.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.2 million.

Object- And Group-Level Remediation Savings

Evidence and data. Interviewees described the significant remediation effort and subsequent end-user downtime resulting from object- and group-level incidents before investing in DSP. Object- and group-level incidents at the interviewees’ organizations included several annual instances of the following events at the individual or collective level, respectively:

• Unintended modifications to organizational units affecting the organizational structure.
• Unauthorized changes to user account attributes (e.g., passwords, group memberships).
• Deletion or modification of security groups affecting access permissions.
• Compromise of privileged user accounts or service accounts.
• Changes to group policies that impact security settings across the network.

Interviewees stated that DSP detected and automatically reversed unwanted changes to objects and groups in the AD and Entra ID environments quickly and with minimal human intervention from IT teams. While these incidents were not malicious and often were a result of accidental modifications made by employees, they hindered end-user productivity because the affected employees were unable to log in to their computers or access network resources tied to AD or Entra ID credentials, including files, folders, and applications needed to continue working. The resulting productivity losses spanned the duration of IT teams’ remediation efforts, which involved identifying, mitigating, and recovering from the incident to restore normal configurations.

• The network systems analyst in healthcare explained that human operational errors occurred on a weekly basis at their organization, affecting between 300 and several thousand employees depending on the severity of the incident. Before Semperis, remediating these errors took several hours; after the investment, it took 30 minutes.

• The manager in identity management and engineering in healthcare said that before Semperis, fixing role-based access control issues used to take six subject-matter experts (SMEs) several days; now with DSP in place, it takes two SMEs about 2 hours to resolve.
  The manager in identity management and engineering outlined the effort previously required to remediate object- and group-level incidents: “[Before Semperis,] when a user would make an object-level change, we would rely on our cyberthreat team to investigate the changes to ensure that they were done with the appropriate request management. To initiate the investigation with our prior tool, our team would get generated alerts and incident management from the SIEM [security information and event management]. They would then have to use multiple interfaces to determine which changes needed to be undone to generate a report of every individual user and change. This process was time-consuming and highly error-prone, requiring deep expertise. With DSP, unintentional changes made by end users are automatically rolled back to the source and notifications are sent out in lieu of our previous process. We no longer have to do all of the investigation prior to determining the best course of action. Semperis has allowed us to become proactive rather than reactive.”
  The manager continued: “We needed subject-matter experts due to the complexity of the [remediation] process. When an incident occurred, we had to make sure we had resource availability from the right people that could effectively restore the object. This put a strain on our resources because it was hard to get other team members trained on such a specific task.”
  The manager concluded: “Semperis allows us to optimize our operations in regard to addressing [object- and group-level] incidents as they come up. It gives us an ongoing ability to reeducate our teams and train them on new and better ways of fixing issues to get end users back up and running.”

• The senior manager of server architecture in energy reported that it used to take their team up to 8 hours to remediate an AD-related human error before Semperis. After the investment, it took 30 minutes to fully resolve the issue and get end users back into the system to continue their work.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• On average, 1% of the composite organization’s employee count is affected by a major object- or group-level incident.
• In the legacy environment, the composite experiences 5 hours of downtime for remediation per incident.
• With DSP in place, the composite organization realizes a 90% reduction in downtime for remediation.
• The average hourly salary per affected employee is $36.
• The composite organization has 25 major object- and group-level incidents each year.

Risks. Object- and group-level remediation savings may vary depending on the following:

• The number of employees affected per major object- or group-level incidents. Forrester assumes that 1% of the composite organization’s employees are affected in each incident based on interviews; however, this may differ across organizations based on factors such as IT infrastructure complexity and scale, security posture, and access control policies.
• The downtime an organization experiences for major group- and object-level incidents prior to the Semperis investment.
• The average hourly salary per affected employee.
• The number of major object- or group-level incidents per year.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $4.3 million.

Hybrid AD Environment Monitoring Efficiencies

Evidence and data. Interviewees reported significant IT team time savings on monitoring AD and Entra ID environments with Semperis’ DSP tool. With real-time alerting, IT teams were immediately notified of any suspicious or unauthorized changes in hybrid AD environments to promptly address the potential incident rather than conducting manual investigation to locate possible threats. The interviewees noted their organizations realized additional efficiencies from DSP’s automation capabilities, such as automated rollback of malicious changes, which detected potential issues and took predefined corrective actions without intervention from IT team members. DSP’s continuous monitoring helped the interviewees’ organizations identify and address identity security indicators to close gaps and prevent AD- and Entra ID-related attacks.

• The senior manager of server architecture in energy said that their IT access team spent 40% to 50% less time monitoring their hybrid AD environment after investing in DSP. The senior manager said: “Our IT teams’ workload has reduced with Semperis. Typically, we would have to dig through logs to search for things in the environment. Now, we get automatic alerts for issues, which reduces the time spent on monitoring. We also get automated emails that our data is properly backed up and that our AD environment is solid. Semperis has given us peace of mind.”
  They concluded: “Changes to objects and groups in our Active Directory took a toll on our IT access team before DSP. They would have to spend a lot of time figuring out the root cause of the problem. Now, they can easily look at the changes to know what was done, who did it, and quickly remediate the issue.”
• The manager in identity management and engineering explained how automation with DSP has enabled efficiencies across their IT teams: “Our IT teams have seen a lot of efficiencies since we’ve invested in DSP. We’re able to block and even roll back unauthorized changes immediately. Unless changes are a request chain that has been approved, they cannot occur unless channeled appropriately.”
• The CISO in healthcare said: “[DSP] is a solution that is actively watching our Active Directory environment on our behalf. In many ways, it allows us to set it and forget it. It protects our IT teams from having to wear multiple hats and allows them to focus on other things.”
• The network systems analyst in healthcare said: “I get email notifications from DSP every morning with a summary of what’s happening in the AD environment. If there is a red ‘x,’ we have to go in and make adjustments. Otherwise, if everything appears green, I know that the environment doesn’t need any issues addressed. The ease of monitoring is huge. It makes it a lot easier to be able to review highlights first thing in the morning and just continue with my day.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization has six IT FTEs that spend 25% of their time monitoring the hybrid AD environment.
• After investing in Semperis, the composite’s IT FTEs realize a 40% reduction in time spent monitoring the hybrid AD environment, entirely freeing up one to two FTEs to work on other critical tasks.
• The average fully burdened annual salary of an IT FTE is $108,160.
• Since not all time saved is used for additional work, Forrester applies a 75% productivity recapture to the time saved with Semperis to remain conservative.

Risks. Hybrid AD environment monitoring efficiencies may vary depending on the following:

• The number of IT FTEs involved in continuous monitoring of the hybrid AD environment.
• The percentage of time IT FTEs spend monitoring the hybrid AD environment.
• The average fully burdened annual salary of an IT FTE.
• The percentage of productivity recaptured for value-added activities.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $109,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Improved brand credibility. After investing in Semperis, interviewees noted their organizations achieved a more resilient hybrid AD environment that offered a higher degree of data integrity guided by identity security experts with hands-on experience in incident response through Semperis’ breach preparedness and response services. With real-time monitoring, the interviewees’ organizations realized heightened visibility and were thus able to promptly detect and respond to potential threats before they evolved into a large-scale attack. This overall improvement in security posture reinforced a positive brand image, bolstering interviewees’ organizations’ reputations among customers and unlocking new opportunities for business growth.
  
  The CISO in healthcare outlined the importance of maintaining credibility in an industry that handles highly sensitive data: “The reality of healthcare is that we know our patients can choose to go elsewhere. We want them to have every confidence that we’re doing everything we can to protect them and care for them and their information.”
  
  The CISO continued: “Because we deal with so much personal identifying information in our industry, we’re a prime target for a breach attack and theft of patient information. This creates a lot of fear for consumers as a healthcare organization. Part of our culture is making sure they feel safe.”

The technical architect of AD said: “The danger of having an AD attack is not just about a loss in revenue. We are chiefly concerned with how it impacts our reputation as an organization.”

• Improved visibility of hybrid AD environment. Through improved visibility into their hybrid AD environment, interviewees’ organizations gained instant access to valuable insights into user behaviors, facilitating proactive identification of potential risks. With a clearer view of AD and Entra ID changes and configurations, the interviewees’ organizations streamlined remediation processes to minimize downtime and maintain business continuity. Interviewees reported that their organizations ultimately established greater environmental resiliency, minimizing the overall identity attack surface.
  The SVP in financial services said: “With Semperis, we went from zero visibility to full visibility. It’s a huge leap. We now understand what we previously were unaware of within our environment. That’s massive for us.”
  Interviewees’ organizations with hybrid identity environments specifically noted that, as their attack surfaces continued to expand, attacks that may start on-premises could move to the cloud. With Semperis, interviewees noted their organizations were able to see across multiple identity environments to make critical connections to threats that may otherwise have been missed due to siloed data and tools. They also said that continuous monitoring of the hybrid AD environment helped their organizations identify and address hybrid environment security vulnerabilities with security indicators for on-premises AD and Entra ID. Semperis empowered their organizations with a complete picture of exposures across their hybrid AD environment.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Semperis and later realize additional uses and business opportunities, including:

• Maintaining a strong security posture as business grows. Interviewees said that the Semperis investment has provided a secure foundation for sustained business growth. By being able to adapt to evolving cybersecurity challenges, their organizations were able to scale their hybrid AD environments securely without compromising their overall security posture or violating industry compliance standards. Achieving a more resilient infrastructure with products purpose-built by identity security experts for comprehensive cyber resilience allowed the interviewees’ organizations to mitigate vulnerabilities that inevitably arose as the potential surface area of an attack increased.
  The CISO in healthcare described how Semperis enabled a unified AD environment across existing and new business segments: “We just completed our initial rollout as part of a recent expansion within our footprint. [Semperis allowed] these new segments of our business to level-set their AD environment within the larger organization.”
  They continued: “Employees in the new segments told us that their previous solution was strictly a backup and wasn’t even making sure the backup was fully clean and free of malware. Semperis is doing what their previous tool was doing, plus 1,000%. They immediately got rid of their incumbent vendor and could not get the paperwork done quick enough — that’s how much they wanted Semperis.”
  The senior manager of server architecture in energy discussed their plans to leverage Semperis to maintain resiliency as their organization continued to grow its AD environment: “We are looking at expanding our footprint with Semperis in the coming year to include four additional domain controllers. There’s a lot of segmentation we have to do inside our environment to keep operations and our pipeline systems separated, which will require more domains for our base environment. We plan to use Semperis as a standard tool across all of these environments.”
  The senior manager continued: “We are using Semperis as part of our strategy to make sure [an AD attack] never happens. We want to create an air-tight environment, and Semperis is the tool that we’re currently using to take our backups and move them into a unified, protected environment.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Appendix A).